VULNpocalypse
CriticalVulnerabilityActive

Synology warns of active C3RB3R (Cerber) ransomware hitting NAS devices through a patched DSM flaw

Synology says attackers are exploiting a patched DSM vulnerability to deploy C3RB3R (Cerber) ransomware on internet-exposed NAS devices.

Published
Updated
Fixed in
DSM 7.2.2-72806-1, DSM 7.2.1-69057-6, DSM 7.2-64570-4, DSM 7.1.1-42962-7, DSM 6.2.4-25556-8
Exploitation
Yes. Synology says it identified threat actors exploiting the flaw; victims report encrypted files with a .L0CK3D extension and a read-me3.txt ransom note. The exact CVE used is not confirmed

Live scores

CVE-2024-10441
EPSS
0.013
some chance of attack soon
VEDAS
0.981
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2024-50629
EPSS
0.319
likely to be attacked soon
VEDAS
0.982
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2024-10445
EPSS
0.004
low predicted chance of attack
VEDAS
0.982
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

Synology published an advisory urging DSM users to update after it identified threat actors exploiting a vulnerability to attack NAS devices running outdated versions of DSM (BleepingComputer). Synology said the attacks “aim to encrypt data and extort ransom” (The Hacker News).

Victims found their files encrypted with a “.L0CK3D” extension and a ransom note named “read-me3.txt” dropped in each affected directory (The Hacker News). The note demands the purchase of a “C3rb3r Decryptor” from a dark web portal, with users reporting prices of thousands of dollars (BleepingComputer). The ransomware scanner skips 27 directories and extensions, including BAT, DLL, EXE, LNK, MOD, MSI and SYS, to avoid crashing the system (The Hacker News). Security teams provisionally identified the ransomware as C3RB3R, also called Cerber and CerberImposter (CyberSecurityNews).

Which vulnerability: not confirmed. Synology did not name the exploited flaw. It said the vulnerability was patched in December 2024 and pointed to its November 2024 advisory Synology_SA_24_20 (BleepingComputer). That advisory, disclosed after Pwn2Own 2024, lists three flaws, the most serious a critical remote code execution bug (Synology):

CVEFlawCVSS
CVE-2024-10441Improper encoding in the system plugin daemon, leading to remote code execution (critical)9.8
CVE-2024-50629Improper encoding in the webapi component, allowing remote attackers to read limited files5.3
CVE-2024-10445Improper certificate validation in the update function, allowing writing of limited files4.3

Synology rates CVE-2024-10441 critical and the other two moderate, and marks the advisory resolved (Synology).

Public reporting has not established which vulnerability was used in each incident, or whether attackers combined them (CyberSecurityNews). Researchers had not ruled out an unknown vulnerability, and reporting notes the attribution to older patched weaknesses does not fully explain the apparent mismatch; no new zero-day is confirmed (CyberSecurityNews). Separately, Qihoo 360 cited a 2026 pair, CVE-2026-13684 and CVE-2026-13639 (both CVSS 9.8, Synology_SA_26_13, September 2026), and described C3RB3R as having a long history of targeting NAS devices (The Hacker News).

Dates. The 360 Security Team and Solar Emergency Response Team reported the attacks on October 29 (CyberSecurityNews). Users first reported attacks more than two weeks before early November, on BleepingComputer’s forums and on Reddit (BleepingComputer). Reporting notes a date inconsistency: Synology’s advisory says the flaw was patched in December 2024 while linking to a November 2024 advisory (BleepingComputer).

Scale of exposure. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, though it does not say how many are patched or are honeypots (BleepingComputer). No group or state attribution has been made beyond the provisional C3RB3R identification (CyberSecurityNews).

Am I affected?

You are at risk if you run a Synology NAS on an outdated version of DSM (DiskStation Manager), especially with the management web interface reachable from the internet (BleepingComputer). Synology_SA_24_20 lists the affected branches as DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2, so any build below the fixed versions below is affected; BeeStation OS is fixed in 1.1-65374 (Synology). The news sources name no specific NAS models.

The fixed builds listed in Synology_SA_24_20 are the historical patch thresholds, not the latest releases; install the newest version your model supports (Synology):

DSM branchFixed in
DSM 7.2.27.2.2-72806-1 or above
DSM 7.2.17.2.1-69057-6 or above
DSM 7.27.2-64570-4 or above
DSM 7.17.1.1-42962-7 or above
DSM 6.26.2.4-25556-8 or above

Signs of compromise: files renamed with a “.L0CK3D” extension and a “read-me3.txt” ransom note in affected folders (The Hacker News). Also check for unusual logins, unknown administrator accounts and suspicious scheduled tasks (CyberSecurityNews).

What to do now

  1. Update DSM immediately to the latest version supported by your model. Synology strongly urges all users running vulnerable versions to update to protect their systems (The Hacker News).
  2. Enable automatic updates so DSM stays current (The Hacker News).
  3. Take the management interface off the internet. Block access to the DSM management web interface, and remove direct internet access to DSM management and SSH, using a VPN for remote connections (BleepingComputer), (CyberSecurityNews).
  4. Enable two-factor authentication on administrator accounts (CyberSecurityNews).
  5. Check for compromise. Look for unusual logins, unknown administrators and suspicious scheduled tasks (CyberSecurityNews).
  6. Keep independent offline or off-site backups. Updating does not restore files already encrypted, but offline backups may help you recover (CyberSecurityNews).

Sources